summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
* bna: Restore VLAN filter tableRasesh Mody2010-12-261-2/+27
| | | | | | | | | | Change Details: - Retrieve the VLAN configuration from the networking stack and apply it to the base interface during ifconfig up Signed-off-by: Debashis Dutt <ddutt@brocade.com> Signed-off-by: Rasesh Mody <rmody@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bna: Removed unused codeRasesh Mody2010-12-263-253/+3
| | | | | | | | | Change Details: - Remove unused APIs and code cleanup Signed-off-by: Debashis Dutt <ddutt@brocade.com> Signed-off-by: Rasesh Mody <rmody@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bna: IOC uninit check and misc cleanupRasesh Mody2010-12-262-65/+2
| | | | | | | | | | | | | Change Details: - Added a check in ioc firmware lock function to see if IOC is in BFI_IOC_UNINIT state or not. If it is not in UNINIT state and the last IOC boot was not done by OS driver, force IOC state to BFI_IOC_UNINIT - Unused macro and API cleanup Signed-off-by: Debashis Dutt <ddutt@brocade.com> Signed-off-by: Rasesh Mody <rmody@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bna: Fix for TX queueRasesh Mody2010-12-263-6/+25
| | | | | | | | | | | | | Change Details: - Call netif_wake_queue() if we have freed up sufficient elements at the end of completion processing - Add netif_queue_stopped counter back to bnad_drv_stats {} - Get netif_queue_stopped value from stack - Remove BUG_ON() on value returned by pci_unmap_addr() Signed-off-by: Debashis Dutt <ddutt@brocade.com> Signed-off-by: Rasesh Mody <rmody@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bna: Enable pure priority tagged packet reception and rxf uninit cleanup fixRasesh Mody2010-12-261-0/+25
| | | | | | | | | | | | Change Details: - Enable reception of pure priority tagged packets by default by turning on VLAN Id = 0 - Clear the promiscuous mode, all multicast mode flags when bna_rxf_uninit is called Signed-off-by: Debashis Dutt <ddutt@brocade.com> Signed-off-by: Rasesh Mody <rmody@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bna: Fix ethtool register dump and reordered an APIRasesh Mody2010-12-262-9/+3
| | | | | | | | | | Change Details: - Removed semaphore register dump from ethtool - Moved netif_carrier_off() call to before calling bna_init() Signed-off-by: Debashis Dutt <ddutt@brocade.com> Signed-off-by: Rasesh Mody <rmody@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bna: Port enable disable sync and txq priority fixRasesh Mody2010-12-264-39/+116
| | | | | | | | | | | Change Details: - Fixed port enable/disable sync through a change in LL port state machine - Change txq->priority masking to 0x7 (3 bits) from 0x3 (2 bits) Signed-off-by: Debashis Dutt <ddutt@brocade.com> Signed-off-by: Rasesh Mody <rmody@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* bna: TxRx and datapath fixRasesh Mody2010-12-262-197/+178
| | | | | | | | | | | | Change Details: - Check HW ready condition before accessing h/w register in data-path - Postpone clean-up of data buffers to the data-path restart path and wait in the cleanup routines for in-flight DMA to complete - Separate out Tx completion processing from Rx poll routine Signed-off-by: Debashis Dutt <ddutt@brocade.com> Signed-off-by: Rasesh Mody <rmody@brocade.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Add FCoE support on 57712Michael Chan2010-12-234-14/+2585
| | | | | | | | | | - Connection ID (cid) management - Slow-path command and response support - Update version to 2.2.11. Reviewed-by: Bhanu Prakash Gollapudi <bprakash@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Add kcq2 support on 57712Michael Chan2010-12-232-21/+56
| | | | | | | The kcq2 (2nd kernel work queue) is used by FCoE on 57712 devices. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Call cm_connect_complete() immediately on errorEddie Wai2010-12-231-2/+14
| | | | | | | | | If we get a path_resp error from userspace, call cm_connect_complete() immediately with error so that bnx2i can react to the error faster. Signed-off-by: Eddie Wai <waie@broadcom.com> Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Check device state before reading the kcq pointer in IRQMichael Chan2010-12-231-5/+7
| | | | | | | If the device is down, the kcq pointer may be NULL. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Support NIC Partition modeMichael Chan2010-12-232-18/+69
| | | | | | | | | | Add a common function cnic_read_bnx2x_iscsi_mac() to read the iSCSI MAC address at any specified shared memory location. In NIC Partition mode, we need to get the MAC address from the MF_CFG area of shared memory. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Use proper client and connection IDs on iSCSI ringMichael Chan2010-12-232-14/+12
| | | | | | | | Use the IDs specified by the bnx2x driver when initializing the ring. We don't have to make code changes when these IDs change in the future. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Improve ->iscsi_nl_msg_send()Michael Chan2010-12-233-12/+25
| | | | | | | | | | | | 1. Change first parameter from cnic_dev to ulp_handle which is the hba pointer. All other similar upcalls are using hba pointer. The callee can then directly reference the hba without conversion. 2. Change return value from void to int so that an error code can be passed back. This allows the operation to be retried. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Prevent "scheduling while atomic" when calling ->cnic_init()Michael Chan2010-12-231-2/+1
| | | | | | | | | cnic_dev_list is protected by rtnl_lock and cnic_dev_lock spin_lock during modifications. When looping on cnic_dev_list and calling ->cnic_init(), we should just hold rtnl_lock since ->cnic_init() may sleep. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* cnic: Fix iSCSI TCP port endian order.Michael Chan2010-12-232-11/+14
| | | | | | | | Pass the TCP port parameter for iSCSI connections to the firmware in proper endian order. Signed-off-by: Michael Chan <mchan@broadcom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
* Merge branch 'for-davem' of ↵David S. Miller2010-12-23181-3073/+27766
|\ | | | | | | ssh://master.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6
| * mac80211: check for CONFIG_MAC80211_LEDS in the tpt_led_trigger declarationLuciano Coelho2010-12-221-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | If CONFIG_MAC80211_LEDS is not set, ieee80211_i.h was failing to compile, because struct led_trigger is only declared when CONFIG_LEDS_TRIGGERS is set. This patch adds ifdefs around the tpt_led_trigger declaration in ieee80211_i.h to avoid the problem. Signed-off-by: Luciano Coelho <luciano.coelho@nokia.com> Acked-by: Johannes Berg <johannes@sipsolutions.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * mac80211: selective throughput LED trigger activeJohannes Berg2010-12-226-18/+76
| | | | | | | | | | | | | | | | | | | | | | The throughput LED trigger was always active when the radio was enabled. In most cases that's likely the desired behaviour, but iwlwifi requires it to be only active when one of the virtual interfaces is actually "connected" in some way. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * mac80211: add throughput based LED blink triggerJohannes Berg2010-12-228-9/+216
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | iwlwifi and other drivers like to blink their LED based on throughput. Implement this generically in mac80211, based on a throughput table the driver specifies. That way, drivers can set the blink frequencies depending on their desired behaviour and max throughput. All the drivers need to do is provide an LED class device, best with blink hardware offload. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * mac80211: make LED trigger names available earlyJohannes Berg2010-12-223-20/+22
| | | | | | | | | | | | | | | | | | | | | | | | | | The throughput trigger will require doing LED classdev/trigger handling before register_hw(), so drivers should have access to the trigger names before it. If trigger registration fails, this will still make the trigger name available, but that's not a big problem since the default trigger will the simply not be found. Signed-off-by: Johannes Berg <johannes.berg@intel.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| * Merge branch 'master' of ↵John W. Linville2010-12-22177-3045/+27469
| |\ | | | | | | | | | | | | | | | | | | | | | | | | git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless-next-2.6 into for-davem Conflicts: drivers/net/wireless/iwlwifi/iwl-1000.c drivers/net/wireless/iwlwifi/iwl-6000.c drivers/net/wireless/iwlwifi/iwl-core.h
| | * rtlwifi: use alloc_workqueueJohn W. Linville2010-12-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | create_workqueue is deprecated. The workqueue usage does not seem to demand any special treatment, so do not set any flags either. Signed-off-by: John W. Linville <linville@tuxdriver.com> Tested-by: Larry Finger <Larry.Finger@lwfinger.net> Acked-by: Tejun Heo <tj@kernel.org>
| | * ath9k: do not limit the chainmask to 1 for legacy modeFelix Fietkau2010-12-203-34/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Restricting the chainmask to 1 for legacy mode disables useful features such as MRC, and it reduces the available transmit power. I can't think of a good reason to do this in legacy mode, so let's just get rid of that code. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k_hw: fix PA predistortion HT40 maskFelix Fietkau2010-12-203-9/+13
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The commit 'ath9k_hw: Disable PAPRD for rates with low Tx power' changed the code that sets the PAPRD rate masks to use only either the HT20 mask or the HT40 mask. This is wrong, as the hardware can still use HT20 rates even when configured for HT40, and the operating channel mode does not affect PAPRD operation. The register for the HT40 rate mask is applied as a mask on top of the other registers to selectively disable PAPRD for specific rates on HT40 packets only. This patch changes the code back to the old behavior which matches the intended use of these registers. While with current cards this should not make any practical difference (according to Atheros, the HT20 and HT40 mask should always be equal), it is more correct that way, and maybe the HT40 mask will be used for some rare corner cases in the future. Cc: Vasanthakumar Thiagarajan <vasanth@atheros.com> Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * mac80211: fix potentially redundant skb data copyingFelix Fietkau2010-12-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When an skb is shared, it needs to be duplicated, along with its data buffer. If the skb does not have enough headroom, using skb_copy might cause the data buffer to be copied twice (once by skb_copy and once by pskb_expand_head). Fix this by using skb_clone initially and letting ieee80211_skb_resize sort out the rest. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * mac80211: skip unnecessary pskb_expand_head callsFelix Fietkau2010-12-201-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | If the skb is not cloned and we don't need any extra headroom, there is no point in reallocating the skb head. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * mac80211: fix initialization of skb->cb in ieee80211_subif_start_xmitFelix Fietkau2010-12-201-1/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The change 'mac80211: Fix BUG in pskb_expand_head when transmitting shared skbs' added a check for copying the skb if it's shared, however the tx info variable still points at the cb of the old skb Signed-off-by: Felix Fietkau <nbd@openwrt.org> Acked-by: Helmut Schaa <helmut.schaa@googlemail.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * wl1251: wl12xx_get_platform_data() returns an ERR_PTRDan Carpenter2010-12-201-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | wl12xx_get_platform_data() returns an ERR_PTR on failure and it never returns a NULL. Signed-off-by: Dan Carpenter <error27@gmail.com> Acked-by: Kalle Valo <kvalo@adurom.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * rtlwifi: Fix use of mutex in interrupt codeLarry Finger2010-12-203-5/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | A previous conversion from semaphoreto mutexes missed the fact that one of the semaphores was used in interrupt code. Fixed by changing to a spinlock. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * MAINTAINERS: Fix typo in rtl8192ce entryLarry Finger2010-12-201-1/+1
| | | | | | | | | | | | | | | Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k: Properly initialize channel table for 2GHzMohammed Shafi Shajakhan2010-12-201-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | ath9k channel table for 2Ghz does not seems to initialize the 'band' parameter.Though it does not seems to cause any visible issue it looks odd when we initialize the 'band' parameter for 5Ghz channel table while not so for 2Ghz. Signed-off-by: Mohammed Shafi Shajakhan <mshajakhan@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * rtl8192ce: Fix typo in Kconfig descriptionAnisse Astier2010-12-201-1/+1
| | | | | | | | | | | | | | | Signed-off-by: Anisse Astier <anisse@astier.eu> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k_hw: remove baseband rfsilent supportFelix Fietkau2010-12-205-43/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | When rfkill is enabled, ath9k_hw unnecessarily configured the baseband to turn off based on GPIO input, however that code was hardcoded to GPIO 0 instead of ah->rfkill_gpio. Since ath9k uses software rfkill anyway, this code is completely unnecessary and should be removed in case anything else ever uses GPIO 0. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath9k: fix queue depth check for forming new aggregatesFelix Fietkau2010-12-202-3/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | To improve aggregation length, there should not be more than two fully formed A-MPDU frames in the hardware queue. To ensure this, the code checks the tx queue length before forming new A-MPDUs. This can reduce the throughput (or maybe even starve out A-MPDU traffic) when too many non-aggregated frames are in the queue. Fix this by keeping track of pending A-MPDU frames (even when they're sent out as single frames), but exclude rate control probing frames to improve performance. Signed-off-by: Felix Fietkau <nbd@openwrt.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * rtl8192ce: drop 'rtl8192c-' prefix from filesJohn W. Linville2010-12-2021-52/+52
| | | | | | | | | | | | | | | Signed-off-by: John W. Linville <linville@tuxdriver.com> Tested-by: Larry Finger <Larry.Finger@lwfinger.net>
| | * mac80211: Remove unused third address from mesh address extension header.Javier Cardona2010-12-204-25/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The Mesh Control header only includes 0, 1 or 2 addresses. If there is one address, it should be interpreted as Address 4. If there are 2, they are interpreted as Addresses 5 and 6 (Address 4 being the 4th address in the 802.11 header). The address extension used to hold up to 3 addresses instead of the current 2. I'm not sure which draft version changed this, but it is very unlikely that it will change again given the state of the approval process of this draft. See section 7.1.3.6.3 in current draft (8.0). Also, note that the extra address that I'm removing was not being used, so this change has no effect on over-the-air frame formats. But I thought I better remove it before someone does start using it. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath5k: Set available antenna information for cfg80211Bruno Randolf2010-12-201-0/+4
| | | | | | | | | | | | | | | Signed-off-by: Bruno Randolf <br1@einfach.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * nl80211: Export available antennasBruno Randolf2010-12-202-0/+14
| | | | | | | | | | | | | | | | | | | | | | | | Export the information which antennas are available for configuration as TX or RX antennas via nl80211. Signed-off-by: Bruno Randolf <br1@einfach.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * cfg80211: Separate available antennas for RX and TXBruno Randolf2010-12-202-10/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | As has been pointed out by Daniel Halperin some devices (e.g. Intel IWL5100) can only TX from a subset of RX antennas, so use separate availability masks for RX and TX. Signed-off-by: Bruno Randolf <br1@einfach.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * mac80211: Send mesh non-HWMP path selection frames to userspaceJavier Cardona2010-12-206-11/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | Let path selection frames for protocols other than HWMP be sent to userspace via NL80211_CMD_REGISTER_FRAME. Also allow userspace to send and receive mesh path selection frames. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * mac80211: Let userspace enable and configure vendor specific path selection.Javier Cardona2010-12-2012-36/+214
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Userspace will now be allowed to toggle between the default path selection algorithm (HWMP, implemented in the kernel), and a vendor specific alternative. Also in the same patch, allow userspace to add information elements to mesh beacons. This is accordance with the Extensible Path Selection Framework specified in version 7.0 of the 802.11s draft. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * mac80211: Rename mesh_params to mesh_config to prepare for mesh_setupJavier Cardona2010-12-204-33/+38
| | | | | | | | | | | | | | | | | | | | | | | | | | | Mesh parameters can be to setup a mesh or to configure it. This patch renames the ambiguous name mesh_params to mesh_config in preparation for mesh_setup. Signed-off-by: Javier Cardona <javier@cozybit.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * rtlwifi: Switch locking from semaphores to mutexesLarry Finger2010-12-164-22/+22
| | | | | | | | | | | | | | | Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * rtl8192ce: Update MAINTAINERSLarry Finger2010-12-161-0/+10
| | | | | | | | | | | | | | | Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath5k: Fix surveyBruno Randolf2010-12-162-12/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The old survey implementation was broken and returned nonsense data. Clear cycle counters and survey data on reset. Since the cycle counters easily overflow it's better to keep a local version of collected survey data (in ms resolution, instead of clockrate) and update this every time survey is retrieved. If survey is retrieved often enough to avoid cycle counter overflows this works fine, otherwise we could update survey more often, like ath9k does. Still only the survey for the current channel is kept. Signed-off-by: Bruno Randolf <br1@einfach.org> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * rtl8192ce: Fix build on powerpcLarry Finger2010-12-161-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | After merge of the rtl8192ce driver, a powerpc build fails with: drivers/net/wireless/rtlwifi/rtl8192ce/rtl8192c-sw.c: In function 'rtl92c_init_sw_vars': drivers/net/wireless/rtlwifi/rtl8192ce/rtl8192c-sw.c:76: error: implicit declaration of function 'vmalloc' drivers/net/wireless/rtlwifi/rtl8192ce/rtl8192c-sw.c:76: warning: cast to pointer from integer of different size drivers/net/wireless/rtlwifi/rtl8192ce/rtl8192c-sw.c: In function 'rtl92c_deinit_sw_vars': drivers/net/wireless/rtlwifi/rtl8192ce/rtl8192c-sw.c:91: error: implicit declaration of function 'vfree' The problem is fixed by explicitly including the appropriate header. Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * ath: fix NULL pointer dereference on reg_notifier()Luis R. Rodriguez2010-12-161-0/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The reg_notifier() was recently updated as being capable of having the request passed as NULL, fix ath to follow this API change. Without this we end up oopsing: BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 IP: [<ffffffffa02fb8cb>] ath_reg_notifier_apply+0x5b/0xa0 [ath] PGD b4c4c067 PUD b4c4d067 PMD 0 Oops: 0000 [#1] SMP DEBUG_PAGEALLOC last sysfs file: /sys/devices/pci0000:00/0000:00:1b.0/uevent CPU 1 Modules linked in: <etc> Pid: 436, comm: modprobe Not tainted 2.6.37-rc5-wl+ #36 6460DWU/6460DWU RIP: 0010:[<ffffffffa02fb8cb>] [<ffffffffa02fb8cb>] ath_reg_notifier_apply+0x5b/0xa0 [ath] RSP: 0018:ffff8800b6f6baa8 EFLAGS: 00010246 RAX: ffff8800b527b254 RBX: ffff8800b532c180 RCX: 0000000000000018 RDX: ffff8800b530c108 RSI: 0000000000000000 RDI: ffff8800b532c180 RBP: ffff8800b6f6baa8 R08: ffff8800b532f268 R09: 0000000000000235 R10: 00000000000016ad R11: 0000000000000018 R12: 0000000000000000 R13: 0000000000000016 R14: ffff8800b532f268 R15: 0000000000000011 FS: 00007f0c53104700(0000) GS:ffff8800bed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000004 CR3: 00000000b6531000 CR4: 00000000000006e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process modprobe (pid: 436, threadinfo ffff8800b6f6a000, task ffff8800b404dc40) Stack: ffff8800b6f6bac8 ffffffffa03ea651 ffff8800b532c180 ffff8800b527b254 ffff8800b6f6bb38 ffffffffa01835ca ffffffffa019ed00 00000000a019ed80 0000000000000002 ffff880000000002 ffffffffa0366140 0000000010aee572 Call Trace: [<ffffffffa03ea651>] ath9k_reg_notifier+0x41/0x50 [ath9k] [<ffffffffa01835ca>] wiphy_update_regulatory+0x4ba/0x5a0 [cfg80211] [<ffffffffa0366140>] ? ieee80211_register_hw+0xa0/0x5b0 [mac80211] [<ffffffffa0366140>] ? ieee80211_register_hw+0xa0/0x5b0 [mac80211] [<ffffffffa017f994>] wiphy_register+0x1d4/0x360 [cfg80211] [<ffffffff8114b918>] ? __kmalloc+0x108/0x1c0 [<ffffffffa0366223>] ieee80211_register_hw+0x183/0x5b0 [mac80211] [<ffffffffa03eb49b>] ath9k_init_device+0x66b/0x850 [ath9k] [<ffffffffa03f9dd6>] ath_pci_probe+0x2f6/0x3c0 [ath9k] [<ffffffff81037529>] ? default_spin_lock_flags+0x9/0x10 [<ffffffff812e19cf>] local_pci_probe+0x5f/0xd0 [<ffffffff812e2bf1>] pci_device_probe+0x101/0x120 [<ffffffff81390aca>] ? driver_sysfs_add+0x7a/0xb0 [<ffffffff81390c26>] driver_probe_device+0x96/0x1c0 [<ffffffff81390deb>] __driver_attach+0x9b/0xa0 [<ffffffff81390d50>] ? __driver_attach+0x0/0xa0 [<ffffffff81390008>] bus_for_each_dev+0x68/0x90 [<ffffffff81390a4e>] driver_attach+0x1e/0x20 [<ffffffff81390309>] bus_add_driver+0xe9/0x290 [<ffffffffa0407000>] ? ath9k_init+0x0/0x4d [ath9k] [<ffffffff81391130>] driver_register+0x80/0x150 [<ffffffffa0407000>] ? ath9k_init+0x0/0x4d [ath9k] [<ffffffffa0407000>] ? ath9k_init+0x0/0x4d [ath9k] [<ffffffff812e2e76>] __pci_register_driver+0x56/0xd0 [<ffffffffa03f9ec3>] ath_pci_init+0x23/0x30 [ath9k] [<ffffffffa040702b>] ath9k_init+0x2b/0x4d [ath9k] [<ffffffff81002053>] do_one_initcall+0x43/0x190 [<ffffffff8109fb5b>] sys_init_module+0xbb/0x200 [<ffffffff8100c042>] system_call_fastpath+0x16/0x1b Code: <who even reads this anyway? haha, ok you do> RIP [<ffffffffa02fb8cb>] ath_reg_notifier_apply+0x5b/0xa0 [ath] RSP <ffff8800b6f6baa8> CR2: 0000000000000004 ---[ end trace 6d03d3c7eda9f06b ]--- Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
| | * cfg80211: fix null pointer dereference with a custom regulatory requestLuis R. Rodriguez2010-12-162-2/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Once we moved the core regulatory request to the queue and let the scheduler process it last_request will have been left NULL until the schedular decides to process the first request. When this happens and we are loading a driver with a custom regulatory request like all Atheros drivers we end up with a NULL pointer dereference. We fix this by checking if the request was a custom one. BUG: unable to handle kernel NULL pointer dereference at 0000000000000004 IP: [<ffffffffa016de87>] freq_reg_info_regd.clone.2+0x27/0x130 [cfg80211] PGD 71f91067 PUD 712b2067 PMD 0 Oops: 0000 [#1] PREEMPT SMP last sysfs file: /sys/devices/pci0000:00/0000:00:1d.7/usb2/2-1/firmware/2-1/loading CPU 0 Modules linked in: ath9k_htc(+) ath9k_common ath9k_hw ath <etc> Pid: 3094, comm: insmod Tainted: G W 2.6.37-rc5-wl #16 INVALID/28427ZQ RIP: 0010:[<ffffffffa016de87>] [<ffffffffa016de87>] freq_reg_info_regd.clone.2+0x27/0x130 [cfg80211] RSP: 0018:ffff88007045db78 EFLAGS: 00010282 RAX: 0000000000000000 RBX: ffffffffa047d9a0 RCX: ffff88007045dbd0 RDX: 0000000000004e20 RSI: 000000000024cde0 RDI: ffff8800700483e0 RBP: ffff88007045db98 R08: ffffffffa02f5b40 R09: 0000000000000001 R10: 000000000000000e R11: 0000000000000001 R12: 0000000000000000 R13: ffff88007004e3b0 R14: 0000000000000000 R15: ffff880070048340 FS: 00007f635a707700(0000) GS:ffff880077400000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b CR2: 0000000000000004 CR3: 00000000708a9000 CR4: 00000000000006f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 Process insmod (pid: 3094, threadinfo ffff88007045c000, task ffff8800713e3ec0) Stack: ffffffffa047d9a0 0000000000000000 ffff88007004e3b0 0000000000000000 ffff88007045dc08 ffffffffa016e147 000000007045dc08 0000000000000002 ffff8800700483e0 ffffffffa02f5b40 ffff88007045dbd8 0000000000000000 Call Trace: [<ffffffffa016e147>] wiphy_apply_custom_regulatory+0x137/0x1d0 [cfg80211] [<ffffffffa047a690>] ? ath9k_reg_notifier+0x0/0x50 [ath9k_htc] [<ffffffffa02f47f7>] ath_regd_init+0x347/0x430 [ath] [<ffffffffa047b1f5>] ath9k_htc_probe_device+0x6c5/0x960 [ath9k_htc] [<ffffffffa0472a2c>] ath9k_htc_hw_init+0xc/0x30 [ath9k_htc] [<ffffffffa04747e6>] ath9k_hif_usb_probe+0x216/0x3b0 [ath9k_htc] [<ffffffffa03bb6bc>] usb_probe_interface+0x10c/0x210 [usbcore] [<ffffffff812aec26>] driver_probe_device+0x96/0x1c0 [<ffffffff812aedf3>] __driver_attach+0xa3/0xb0 [<ffffffff812aed50>] ? __driver_attach+0x0/0xb0 [<ffffffff812adaae>] bus_for_each_dev+0x5e/0x90 [<ffffffff812ae8c9>] driver_attach+0x19/0x20 [<ffffffff812ae438>] bus_add_driver+0x168/0x320 [<ffffffff812af071>] driver_register+0x71/0x140 [<ffffffff811fc4a8>] ? __raw_spin_lock_init+0x38/0x70 [<ffffffffa03ba39c>] usb_register_driver+0xdc/0x190 [usbcore] [<ffffffffa03a2000>] ? ath9k_htc_init+0x0/0x4f [ath9k_htc] [<ffffffffa047499e>] ath9k_hif_usb_init+0x1e/0x20 [ath9k_htc] [<ffffffffa03a202b>] ath9k_htc_init+0x2b/0x4f [ath9k_htc] [<ffffffff8100212f>] do_one_initcall+0x3f/0x180 [<ffffffff8109ef5b>] sys_init_module+0xbb/0x200 [<ffffffff8100bf52>] system_call_fastpath+0x16/0x1b Code: <etc, who cares> RIP [<ffffffffa016de87>] freq_reg_info_regd.clone.2+0x27/0x130 [cfg80211] RSP <ffff88007045db78> CR2: 0000000000000004 ---[ end trace 79e4193601c8b713 ]--- Reported-by: Sujith Manoharan <Sujith.Manoharan@atheros.com> Signed-off-by: Luis R. Rodriguez <lrodriguez@atheros.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-29 21:08:03 +0100